auto-updater

To safely review skill updates, you can generate unified diffs comparing installed community skills against source registries using fixed commit SHAs, ensuring changes are explicitly approved before application.

Preventing unsafe hooks and MCP configuration changes requires enforcing explicit human approval for diffs affecting .mcp.json, hooks.json, and allowed-tools before any skill update is applied.

Commit SHA comparison tracks community skill versions by checking installed skills against the source registry using immutable commit SHAs instead of mutable tags or branches to guarantee version integrity.

You can run skills-qa scanning as a safety gate before applying updates, automatically rejecting regressions and enforcing human review for security-relevant diffs to ensure update safety.

When installed skills fall outside their freshness window, the system detects the expiration and offers re-check options or re-verification to ensure the skills remain current and secure.

The auto-updater works with managed-agent workflows by providing controlled maintenance of installed skills, triggered by explicit commands like checking or auto-updater agent calls for safe updates.